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AMENDMENTS TO THE CLAIMS 

This listing will replace all prior versions, and listings, of claims in the application: 
Listing of Claims: 

1. (canceled) 

2. (currently amended) The dev i ce accord i ng to c l a i m G2, A device for 
checking a logical software engine for controlling and commanding a railway plant 
comprising a plurality of wayside operating units, the device comprising: 

a central processing unit generating a command signal to the plurality of operating 
units, the plurality of operating units being configured to receive the command signal and 
generate a control signal about an operating condition, the control signal being transmitted 
to the central processing unit, the central processing unit reading the control signal and 
processing the command signal according to an operation protocol; and 

one or more memories storing a logical engine commanding the railway plant, a plant 
simulation program, and a graphic program, 

wherein the logical engine commands and controls the simulation program, 

wherein the plant simulation program simulates a railway plant structure and 
operating modes of the plurality of operating units, the plant simulation program comprising 
a control and command logical program and a simulation program representing operative 
functions of one or more plant components, 

wherein a plant component is an operating unit, a structural element, an area of the 
railway plant, or the entire plant, and the plant component is univocally associated to a 
virtual image of the plant component generated by the graphic program, 

wherein the graphic program generates a different image of each plant component 
by representing a different graphic aspect condition of the plant component, each aspect 
condition being associated to a predetermined value of a state variable describing the 
operating condition of a corresponding plant component, or to a command variable 
commanding a commutation or a maintenance of an operative state of the plant component, 
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wherein different virtual images corresponding to the different graphic aspect 
conditions of the plant component are different one from the other and reproduce 
schematically real modifications of aspects of the plant component in different operating 
conditions , 

wherein the plant simulation program comprises one or more Boolean algorithms 
including variables, and wherein the variables are defined to represent the control signals of 
different state or operating conditions of the plurality of operating units, and the command 
signals for commutating and maintaining the different state and operating conditions of the 
plurality of operating units. 

3. (currently amended) The device according to claim [[62]] 2, further 
comprising means for displaying an image of plant behavior, wherein the means for 
displaying are controlled by the logical engine as variable lists univocally associated to the 
plurality of operating units as report files, and wherein the report files list one or more of the 
plurality of operating units and the associated state and command variables. 

4. (currently amended) The device according to claim [[62]] 2, wherein the 
plant simulation program comprises means for setting starting operating conditions of the 
railway plant and means for simulating anomalous situations of the plurality of operating 
units, in order to check the reaction of the railway plant to the anomalous situations. 

5. - 6. (canceled) 

7. (previously presented) The device according to claim 59, wherein each relay in 
the relay network is simulated by a logical program of Boolean type, wherein the relay 
network provides relay and commutation commands, wherein single state conditions of the 
relay and commutation commands are represented by state and command variables, and 
wherein the graphic programs for representing relays are such as to associate relay graphic 
aspects that are univocally associated to values of said state and command variables. 

8. (currently amended) The device according to claim 59, further 
comprising means for scheduling and configuring images and state and command variable 
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lists of virtual operating units corresponding to a desired operational and state condition of 
the plant in conjunction with a predetermined operation situation, wherein means are 
provided for checking visually a correct operation of the virtual operating units, wherein 
automatic check means are further provided comparing, and for sending an error message, 
when i n case of non- i den t i t y, be t ween one or more of a predetermined nominal image, a 
nominal table, and a list of desired state and command variables in a virtual model of the 
plant , and are not the same as one or more of an image, a table, and state and command 
variables that are actually processed during the operation of the logical engine. 

9. (previously presented) The device according to claim 8, further comprising 
means for displaying graphically and analytically which operating units have a non-correct 
condition, and the corresponding state and command variables. 

10. (previously presented) The device according to claims 8, wherein the 
automatic check means are configured to analyze the simulated representation of the relay 
network, indicating which relays have not been commutated in the correct condition and the 
corresponding commutation state and command variables. 

1 1 . (previously presented) The device according to claim 8, further comprising 
means for automatically correcting the logical engine according to possible corrections made 
by a user to the state and commands variables, the state and command variables being 
manually modified because of a state and command error of one or more of a virtual 
operating unit and a relay within a corresponding command logical circuit situated in a virtual 
model of the plant and relay network. 

12. (previously presented) The device according to claim 8, wherein modification 
means provide modification interventions both of alphanumeric type, which modification 
interventions are executed on report files of state and command variables, and aspect 
interventions for graphically modifying the aspect of an operating unit and the relay, which 
aspect interventions correspond to the state of said operating unit and of said relay, and 
wherein analysis and interpretation means analyze state and command variable values that 
are manually set to correct any wrong values, analyze the logical engine, and modify the 
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logical engine's code to commute an operating unit and a relay to the correct state condition, 
when an operating condition occurs due to which the logical engine had previously 
generated an error signal. 

1 3. (previously presented) The device according to claim 8, further comprising a 
Boolean simulation program simulating plant operations, further comprising means for 
associating operating units and plant structural elements so to generate and find areas of 
the virtual plant and further find the corresponding parts of the logical engine that have plant 
components that recur in a plurality of plants, and so as to load and reuse in new plants 
having equal components both the Boolean simulation program, the graphic display 
program, and parts of the logical engine. 

14. (currently amended) The device according to claim [[62]] 2, further 
comprising means for connecting and interfacing with a validation and certification system 
that is based on a system different from the logical engine for generating command and 
control signals. 

15. (previously presented) The device according to claim 14, wherein the 
validation and certification system comprises a Boolean algorithm checker, wherein the plant 
simulation program is configured to generate the control and command logical signals 
during execution of a test step, and wherein validation and certification means are 
configured to compare the command and control signals generated by the plant simulation 
program with the command and control signals generated by the Boolean algorithm checker 
and determine whether the plant simulation program and the Boolean algorithm checker 
produce identical results. 

1 6. (canceled) 

17. (previously presented) The device according to claims 60, wherein the 
additional program and the plant simulation software are compared by comparing command 
and state variables of operating units and relays of the virtual relay network, both 
numerically and graphically. 
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1 8. (previously presented) The device according to claim 1 7, further comprising 
means for displaying, in a combined way, graphic images of plant state conditions obtained 
with both the additional program and the plant simulation software. 

1 9. (previously presented) The device according to claim 1 8, further comprising 
means for displaying, by an overlap, plant layout images according to the additional program 
and the plant simulation software, wherein the overlapping highlights the possible 
differences between the plant images generated by the additional program and the plant 
simulation software, and wherein the possible differences are graphically highlighted in a 
visually relevant way. 

20. (previously presented) The device according to claim 60, wherein two 
different comparison modes with a virtual plant are provided in the logical engine, the two 
different comparison modes comprising a first comparison mode having a Boolean equation 
system and a second comparison mode having report files, the result of the first comparison 
mode being means to identify plant conditions wherein a difference has been noticed and 
must be subjected to the second comparison mode. 

21 . (previously presented) The device according to claim 20, wherein a 
comparison relevant to the plant conditions obtained by the different comparison modes is 
firstly executed, and wherein the parts of the program are identified, for which the 
comparison is definable within the Boolean equation system, in order to determine where 
actions are possible to correct the program. 

22. (previously presented) The device according to claim 60, wherein the 
validation and certification system is configured to analyze, based on diversity, logical 
programs for simulating one or more of a single operating unit, a plant area, the entire plant, 
and a logical program for simulating a relay network, and wherein the validation and 
certification system is configured to extend the analyzing, based on the diversity, even to 
programs for graphically representing one or more of an operating unit and a relay. 
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23. (currently amended) The device according to claim [[62]] 2, further 
comprising a network interface, wherein the device comprises a non-vital node of the railway 
plant, and wherein the device further comprises means for quickly modifying and for virtually 
validating the control and command logical program. 

24. (previously presented) The device according to claim 23, wherein the device 
is configured to operate as a diagnostic and supervisory tool for proper operation of the 
railway plant, and wherein the device reproduces a simulated plant simulating the actual 
railway plant in a desired state condition, the device further comprising a comparator 
between an actual state condition of the railway plant and a state condition of the simulated 
plant. 

25. (previously presented) The device according to claim 23, wherein the device 
is configured to simulate emergency interventions before applications to the railway plant, 
and wherein in an emergency situation it is possible the device is further configured to 
simulate several intervention and command possibilities to be executed on the railway plant, 
thereby indicating an optimal choice among the several intervention and command 
possibilities. 

26. (currently amended) The device according to claim [[62]] 2, further 
comprising tools for executing simulating functions with a user interface as used by a 
desired computer operating system, thereby providing an operator with operating windows 
having function buttons, quick choice menus and other functionalities typical of said user 
interface, in addition to the use of a pointing system, selection and command input systems, 
and a keyboard to input numerical data, the operating windows providing graphic images of 
operating units, relays, and other parts of the railway plant. 

27. (previously presented) The device according to claim [[62]] 2, further 
comprising means for setting specific operating conditions and anomalous situations in the 
railway plant, and further for checking the changes in operating conditions in the railway 
plant according to different operating environments. 
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28. (previously presented) The device according to claim 27, wherein manually 
setting means are provided to an operator of the device, wherein the manually setting 
means are configured to impose, at the starting of a cycle for executing control and 
command signals, specific state conditions to the plurality of operating units, wherein 
conditions are provided that cause one or more of the plurality of operating units to operate 
anomalously by operating incorrectly or by failing to operate. 

29. (canceled) 

30. (currently amended) Th e m et hod acco r d i ng t o c l a i m G3, A method of 
checking a software logical engine for controlling and commanding a railway plant 
comprising a plurality of operating units, the method comprising: 

providing a central processing unit generating a command signal of the plurality of 
operating units, the plurality of operating units receiving the command signal and generating 
a control signal about an operating condition, the control signal being transmitted to the 
central processing unit, the central processing unit reading the control signal and processing 
the command signal according to an operation protocol; 

storing a logical engine, a plant simulation program and a graphic program in one or 
more memories, the local engine commanding the railway plant, the plant simulation 
program simulating a railway plant structure and operating modes of the plurality of 
operating units, the plant simulation program comprising a control and command logical 
program and a plant component simulation program representing operative functions of one 
or more plant components, wherein a plant component is an operating unit, structural 
element, area of the railway plant, or the entire plant; 

causing the logical engine to command and control the simulation program; and 
univocally associating a plant component to a virtual image of the plant component, the 
virtual image being generated by the graphic program, 

wherein the graphic program generates a different image of each plant component 
by representing a different graphic aspect condition of the plant component, each aspect 
condition being associated to a predetermined value of a state variable describing the 
operating condition of a corresponding plant component, or to a command variable 
commanding a commutation or a maintenance of an operative state of the plant component, 
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wherein the virtual image of the plant component is a schematic reproduction of the 
plant component, and 

wherein different virtual images corresponding to the different graphic aspect 
conditions of the plant component are different one from the other and reproduce 
schematically real modifications of aspects of the plant component in different operating 
conditions, 

wherein the plant simulation program comprises Boolean algorithms including 
variables, and wherein the variables are defined to represent control signals of different state 
and operating conditions of the plurality of operating units as well as command signals for 
commutating and maintaining the different state and operating conditions of the plurality of 
operating units. 

31 . (currently amended) The method according to claim [[63]] 30^, wherein an 
image of a simulated behavior of the railway plant under the control of the logical engine is 
displayed as variables list univocally associated to the plurality of operating units as report 
files, and wherein the plurality of operating units and the state and command variables 
associated with the plurality of operating units are listed. 

32. (currently amended) The method according to claim [[63]] 30, further 
comprising the step of enabling a user to set operating conditions of the railway plant at 
start-up, and wherein the user is further enabled to set specific conditions of the plurality of 
operating units, thereby verifying a reaction of the operating plant to the set conditions. 

33. (canceled) 

34. (currently amended) The method according to claim [[63]] 30, wherein the 
operation of the logical engine is configured to be represented in parallel and in the alternate 
as a relay network, and wherein a simulating program of relay operation and a simulating 
program of relay network operation are provided, as well as graphic programs representing 
relays univocally associated to the relay simulation program and the graphic program. 
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35. (previously presented) The method according to claim 34, wherein the 
railways plant comprises relays that are configured to receive commutation commands, 
wherein each relay is simulated by a Boolean logical program, wherein individual state 
conditions of the relays and of the commutation commands are represented by state and 
command variables, and wherein graphic programs associate different graphic aspects of 
the relays with values of said state and command variables. 

36. (previously presented) The method according to claim 34, further comprising 
the step of displaying the functional behavior of the railway plant, wherein the display of the 
functional behavior of the railway plant is executed according to two modes, the two modes 
comprising a first mode having a report file that displays values of state variables generated 
by the plant simulation software, and a second mode having a graphic representation of the 
operating condition of plurality of operating units, thereby enabling a user to check in detail 
the plurality of operating units, and the physical operation modes thereof both in an analytic 
way and in a visual way. 

37. (previously presented) The method according to claim 36, further comprising 
the step of setting specific operating conditions of the railway plant, anomalous situations in 
the railway plant, and plant reactions according to several operating environment. 

38. (previously presented) The method according to claim 37, wherein the 
step of setting is implemented at a specific step of the plant simulation program, wherein a 
suitable scheduling event conditions is provided wherein one or more of the plurality of 
operating units operate anomalously by operating incorrectly or by failing to operate. 

39. (canceled) 

40. (previously presented) The method according to claim 61, wherein the 
automatic check is configured to provide a graphic and analytical display of the operating 
unit that has assumed a non-correct condition, and to provide the corresponding state and 
command variables, and the graphic and analytic display of state variables of the simulated 
relay network. 
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41 . (previously presented) The method according to claim 61 , further 
comprising the step of providing automatic tools for correcting the logical engine according 
to possible corrections made by the user to the state and command variables, the state and 
command variables being manually modified because of a state and command error of one 
or more of a virtual operating unit and of a relay in the command logic within a virtual model 
of the relay network. 

42. (previously presented) The method according to claim 41, wherein 
modification interventions are executed both of alphanumeric type on report files of state and 
command variables, and of graphic type on the operating unit and the relay, the graphic 
interventions corresponding to the state of said operating unit and said relay, said 
alphanumeric and graphic interventions being performed by a correction program that 
analyzes state and command variables values that are manually set to correct undesired 
values, and that further analyzes the logical engine and modifies the logical engine's code to 
commute the operating unit and the relay to the desired state conditions when an operating 
condition occurs due to which the logical engine had generated an error. 

43. (previously presented) The method according to claim 61, further 
comprising the step of providing a Boolean simulation program simulating plant operations, 
wherein the read in of areas of the simulated plant operations and the corresponding parts of 
the logical engine comprise plant structures that recur in several plants, so to be able to load 
and reuse both the Boolean simulation program, and a related graphic display program, and 
parts of the logical engine in new plants having equal operations. 

44. (previously presented) The method according to claim 61, further 
comprising the step of providing an alternative and a parallel execution of a check of the 
logical engine during a test step with the plant simulation software, wherein the alternative 
and the parallel execution comprise using a Boolean checker that employs a control and 
command logical program generated with diversity principles and that compares the logical 
engine during the test step with the command and control logical program generated with 
diversity principles. 
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45. (previously presented) The method according to claim 44, further comprising 
the step of providing an additional program for generating the control and command 
instructions related to the test step, wherein the additional program operates according to a 
code different from that of the plant simulation software, wherein the additional program and 
the plant simulation software each comprise a Boolean equation system, and wherein the 
additional program and the plant simulation software are compared by the Boolean checker 
to identify difference in the Boolean equation systems. 

46. (previously presented) The method according to claim 45, wherein the control 
and command logical program is subjected to the test step by using a virtual plant, and 
wherein the results obtained by the control and command logical program and the plant 
simulation software are compared. 

47. (previously presented) The method according to claim 46, further comprising 
the capability of providing a display, both in the shape of comparative tables of variables and 
in the shape of graphic comparisons, of operational differences between the control and 
command logical program and the plant simulation software, the operational differences 
being generated according to diversity criterions, and of operational differences between 
relay networks that correspond to the two Boolean equation systems, the variables and the 
graphic comparisons being highlighted which are different both within the comparative tables 
and within the graphic comparisons. 

48. (previously presented) The method according to claim 47, further comprising 
the step of providing an overlap of graphic images of the plant state conditions obtained by 
the control and command logical program and by the plant simulation software, the 
differences in the overlap of the graphic images of the plant state condition being graphically 
highlighted. 

49. (previously presented) The method according to claim 48, wherein the two 
modes for displaying the functional behavior of the plant are executed in alternative and in 
sequence, wherein the control and command logical program and the plant simulation 
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software are compared at the Boolean equation system level and at the result of the test e 
step, and wherein the sequence order of the two modes are modifyable. 

50. (previously presented) The method according to claim 49, wherein the control 
and command logical program and the plant simulation software are compared with 
comparison steps comprising: 

executing a first comparison in relation to plant conditions obtained by the control 
and command logical program and the plant simulation software; 

identifying, in the basis of the first comparison, on which parts of the control and 
command logical program and of the plant simulation software subsequent comparison 
actions are limitable; 

executing a second comparison in relation to the Boolean equations of the control 
and command logical program and of the plant simulation software, the second comparison 
being limited to the equations that caused the functional divergences that were found in the 
first comparison; and 

executing the possible corrective actions thereof and error detections on the Boolean 
equations identified as responsible for the divergent behavior of the plant. 

51 . (previously presented) The method according to claim 50, wherein the first and 
second comparisons are executed with a program generated according to a different code, 
wherein the capability is provided of executing additional comparison steps related to the 
simulation and the graphic representation of operating units, the plant structure, and the 
relays and the relay network. 

52. (previously presented) The method according to claim 50, further comprising 
the step of certifying the plant simulation software with parallel means, the parallel means 
comprising an additional independent program that executes in parallel the test of the 
Booleans equation system comprised in the plant simulation software, thereby executing a 
double test by performing a plant simulation, the behavior of the simulated plant obtained 
with the plant simulation software in the two separated and parallel test steps being 
compared, and one or more of alert and error files being generated in case of a discrepancy. 
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53. (previously presented) The method according to claim 45, further comprising the 
step of creating an operating connection to remote operating units and remote networks, so 
to be able to command test functions from a remote workstation and to execute alternative 
functions as functions of a non vital node of the plant. 

54. (previously presented) The method according to claim 53, further comprising the 
step of updating the plant simulation software and the test steps in case of a structural 
modification of the plant. 

55. (previously presented) The method according to claim 53, further comprising 
the step supervising and diagnosing the correct operation of the plant by executing a 
comparison between the state of the railway plant and the state conditions of the simulated 
plant. 

56. (previously presented) The method according to claim 53, further comprising 
the step of simulating a virtual emergency for intervention and command on the railway 
plant, thereby implementing on the railway plant only the choice that offers the optimal 
solution under an emergency condition among the possible choices. 

57. (currently amended) The method according to claim [[63]] 30, further 
comprising the step of executing simulation functions with an user interface of an operating 
system displaying operating windows with function buttons, quick choice menus and other 
functionalities within the operating windows, further comprising the step of providing 
pointing means, and a keyboard to input numerical, alphanumerical data, and numerical and 
alphanumerical commands, thereby creating and modifying graphic images of operating 
units, relays, and other parts of the railway plant. 

58. (canceled) 

59. (previously presented) A device for checking a software engine for controlling 
and commanding a plant, the device comprising: 
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at least a computer having at least a central processing unit and at least a memory 
for loading and executing programs; 

a logical engine for commanding the plant, the logical engine being loadable in the at 
least a memory for the execution of the logical engine, the logical engine providing control 
and command signals; 

a plurality of operating units configured to actuate, detect, measure, and/or signal, 
the plurality of operating units being further configured to receive command signals and of 
transmitting control signals about the operating condition of the plant, the logical engine 
reading the control signals provided by the plurality of operating units and processing the 
command signals according to an operation protocol of the plant, 

wherein a plant simulation software is stored in the memory, 

wherein the plant simulation software is designed to be controlled and commanded 
by the logical engine, 

wherein the plant simulation software is loadable and executable by the at least a 
computer, 

wherein the plant software simulation program simulates the plant structure and the 
operating modes of the plurality of operating units provided in the plant, 

wherein a plant component is one of the plurality of plant operating units, a 
predetermined element of the plant, a predetermined area of the plant, or the whole plant, 
wherein each plant component is univocally associated to a single virtual image, wherein the 
virtual image is generated by a graphic program loadable and executable by one of the at 
least a computer, 

wherein the virtual image is associated to the logical engine, 

wherein the graphic program is configured to generate several graphic aspect 
conditions of each plant component, 

wherein each plant component is associated to a predetermined value of a variable 
relevant to the operating condition of the plant component and of a command variable for 
managing the operating state of the plant component, 

further comprising a first program for simulating a relay operation and a second 
program for simulating a relay network operation, 
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further comprising graphic programs for representing relays associated to the first 
program for simulating relay operation and to the second program for simulating relay 
network operation, 

wherein an operation of the logical engine is further represented as an equivalent 
command hardware logic comprising a relay network. 

60. (previously presented) A method for checking a software logical engine for 
controlling and commanding a plant, the method comprising: 

using at least a central processing unit and at least a memory for loading and 
executing programs; 

commanding the plant with a logical engine, the logical engine being loadable in said 
at least a memory for execution of the logical engine, the logical engine providing command 
and control signals; 

receiving command signals and transmitting control signals related to operating 
conditions of a plurality of operating units situated in the plant, the plurality of operating units 
being configured to actuate, detect, measure, and/or signal; 

reading with the logical engine the control signals provided by the plurality of 
operating units; and 

processing the command signals of said plurality of operating units according to an 
operating protocol of the plant, 

wherein a plant simulation software that is controlled and commanded by the logical 
engine is loadable in the at least a memory, 

wherein the plant simulation software is designed to be executed by the at least a 
central processing unit, 

wherein the plant simulation software simulates the plant structure and the operating 
modes of the plurality of operating units provided in said plant, 

further comprising means for connecting and interfacing with a validation and 
certification system that is based on a system different from the logical engine for generating 
command and control signals, 

wherein the validation and certification system comprises an additional separate 
program for generating control and command logical signals generated and memorized in 
the validation and certification system, 
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where i n t he add iti ona l p r ogram is gen er a t ed t h r ough means d i fferen t from t h e p l an t 
s i mu l a ti on sof t ware, 

where i n the add i t i ona l program and the p l ant simu l ation software are compared so to 
ver i fy that the add i t i ona l program and the p l ant s i mu l at i on software produce ident i ca l resu l ts, 

wherein the additional program and the plant simulation software each comprise a 
Boolean equation system, and 

where i n further comprising the steps of: 

comparing the additional program and the plant simulation software a r e compared by 
comparing one or more of, the Boolean equation systems of the additional program and of 
the plant simulation software , or results of simulating tests executed with the additional 
program and the plant simulation software, and 

verifying that the additional program and the plant simulation software produce 
identical results. 

61 . (currently amended) A method for checking a software logical engine for 
controlling and commanding a plant, the method comprising: 

using at least a central processing unit and at least a memory for loading and 
executing programs; 

commanding the plant with a logical engine, the logical engine being loadable in the 
at least a memory for execution of the logical engine, the logical engine providing command 
and control signals; 

receiving command signals and transmitting control signals related to operating 
conditions of a plurality of operating units situated in the plant, the plurality of operating units 
being configured to actuate, detect, measure, and/or signal; 

reading with the logical engine the control signals provided by the plurality of 
operating units; and 

processing the command signals of the plurality of operating units according to an 
operating protocol of the plant, 

wherein a plant simulation software that is controlled and commanded by the logical 
engine is loadable in the at least a memory, 

wherein the plant simulation software is designed to be executed by the at least a 
central processing unit, 
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wherein the plant simulation software simulates the plant structure and the operating 
modes of the plurality of operating units provided in the plant, 

wherein a virtual image of one of the plurality of operating units and of a plant 
structure is univocally associated to the plant operating units and the plant structural 
element, 

wherein the virtual image is generated by a graphic program loadable and 
executable by the central processing unit, wherein the virtual image is associated to the 
logical engine; 

wherein the graphic program is configured to generate several graphic aspect 
conditions of one or more of the plurality of operating units, 

wherein each of the plurality of operating units is associated to a predetermined 
value of a variable relative to an operating condition of the operating unit and of a variable 
related to an operating state of the operating unit, 

wherein the operation of the logical engine is configured to be represented in parallel 
and in the alternate as a relay network, and 

wherein a simulating program of relay operation and a simulating program of relay 
network operation are provided, as well as graphic programs for representing relays 
associated to the relay simulation program and the graphic program, 

further comprising the step of displaying the functional behavior of the plant, wherein 
the display of the functional behavior of the plant is executed according to two modes, the 
two modes comprising a first mode having a report file that displays values of state variables 
generated by the plant simulation software, and a second mode having a graphic 
representation of the operating condition of plurality of operating units, thereby enabling a 

user to check in detail the plurality of operating units, and therefore the physical 
operation modes thereof both in an analytic way and in a direct visual way, 

further comprising the step of setting specific operating conditions of the plant or 
anomalous situations in the plant, and of checking plant reactions according to several 
operating environment, 

further comprising the step of scheduling and configuring images and state and 
command variables of virtual operating units corresponding to desired operational and state 
conditions of the plant and a predetermined situation of operation, and the step of executing 
a visual check of correct operation and an automatic check based on comparing a nominal 
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image and a nominal list of desired state and command variables, and the image and state 
and command variables really processed during the operation of the logical engine, an error 
message being sent i n case of non- i dent i ty between w hen the nominal image and the 
nominal list of the desired state and command variables , and are not the same as t he image 
and state and command variables really processed during the operation of the logical 
engine. 

62. - 63. (canceled) 
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